Reduce throttling threshold, allow throttling config via env vars (#763)

api/catalog/api/docs/README.md

@@ -10,8 +10,8 @@ of openly-licensed works, including articles, songs, videos, photographs,
 paintings, and more. Using this API, developers will be able to access the
 digital commons in their own applications.
 
-Please note that there is a rate limit of 5000 requests per day and 60 requests
-per minute rate limit in place for anonymous users. This is fine for introducing
+Please note that there is a rate limit of 100 requests per day and 5 requests
+per hour rate limit in place for anonymous users. This is fine for introducing
 yourself to the API, but we strongly recommend that you obtain an API key as
 soon as possible. Authorized clients have a higher rate limit of 10000 requests
 per day and 100 requests per minute. Additionally, Openverse can give your key

api/catalog/settings.py

@@ -118,6 +118,9 @@
 
 OAUTH2_PROVIDER_APPLICATION_MODEL = "api.ThrottledApplication"
 
+THROTTLE_ANON_BURST = config("THROTTLE_ANON_BURST", default="5/hour")
+THROTTLE_ANON_SUSTAINED = config("THROTTLE_ANON_SUSTAINED", default="100/day")
+
 REST_FRAMEWORK = {
     "DEFAULT_AUTHENTICATION_CLASSES": (
         "oauth2_provider.contrib.rest_framework.OAuth2Authentication",
@@ -137,8 +140,8 @@
         "catalog.api.utils.throttle.EnhancedOAuth2IdThrottleBurstRate",
     ),
     "DEFAULT_THROTTLE_RATES": {
-        "anon_burst": "60/min",
-        "anon_sustained": "5000/day",
+        "anon_burst": THROTTLE_ANON_BURST,
+        "anon_sustained": THROTTLE_ANON_SUSTAINED,
         "oauth2_client_credentials_sustained": "10000/day",
         "oauth2_client_credentials_burst": "100/min",
         "enhanced_oauth2_client_credentials_sustained": "20000/day",